Bandwidth authorities explained: the nine seats that sign Tor's consensus
Every hour, the Tor network quietly rewrites its address book. The document at the center of that ritual is the consensus, which the Tor Metrics glossary describes as a single document compiled and voted on by the directory authorities once per hour, so that all clients hold the same information about the relays that make up the network. It lists the relays believed to be running, assigns flags such as Guard or Exit, and sets a consensus weight that shapes how much traffic each relay receives. Producing it is the job of a committee small enough to fit around one table.
A deliberately small committee
The current roster is short enough to list in full: moria1, tor26, dizum, gabelmoo, dannenberg, maatuska, longclaw, bastet and faravahar. These nine names are the ones Tor's consensus-health service tracks in every voting round, marking which authorities participated. Researchers who analyzed the consensus for the ACM Internet Measurement Conference described the arrangement plainly: nine directory authorities, "each run by a different trusted organization or individual". Membership is meant to be boring. Seats change rarely, and whoever holds one is expected to run a well-secured server for years, not months. Formally, each authority is a special-purpose relay that maintains a list of currently running relays and periodically publishes a consensus together with the others, in the wording of the Tor community glossary. The design is conservative on purpose. According to the directory protocol specification, authorities hold long-term identity keys that remain offline and certify the medium-term signing keys used day to day, so seizing a routine key does not seize the seat. The specification also recalls why collective voting exists: under Tor's earlier directory design, a single authority that lied "could make clients believe for a time an arbitrarily distorted view" of the network. Requiring several authorities to agree on one document was the fix.Who actually runs the seats
None of this is anonymous infrastructure. moria1, one of the longest-serving authorities, is operated by Roger Dingledine, co-founder of the Tor Project. tor26 is run by Peter Palfrader, dannenberg by the Chaos Computer Club e.V. in Germany and gabelmoo by F3 Netze e.V., another German nonprofit association; the remaining seats are held by individual operators and small organizations with long histories in the project. OrNetStats, an independent relay-diversity monitoring project, publishes the bandwidth authority operators alongside their self-reported contact information, which makes this corner of the network unusually easy to audit from the outside.From scanner to consensus weight
The consensus does more than list relays; it weighs them. Tor's metrics documentation defines a relay's consensus weight as a value based on the bandwidth the relay reports and the bandwidth that directory authorities measure. The measuring is done by dedicated systems known as bandwidth scanners or bandwidth authorities: they reach the network like ordinary clients, time real transfers through each relay, and publish the results in a bandwidth file. Under the bandwidth file specification, the authorities read that file and use its values to scale the weights they assign in their votes. Where several scanners have measured the same relay, the consensus weight is drawn from the median of the measurements, so one faulty or biased scanner cannot dictate a relay's share of the network on its own.Concentrated trust, by design
A committee of nine looks like a single point of failure, and the Tor project has never pretended otherwise. The case for concentration is that a small, publicly known set of professional operators is easier to defend — and harder to infiltrate quietly — than a large, anonymous one. The risk is the mirror image: an adversary who compromised a majority of authorities could, for a window of a few hours, feed clients a distorted view of the network, for example by inflating the weights of relays it controls. That is also why the authorities' network addresses ship hardcoded inside Tor Browser, and why the project treats their integrity as something the public can check for itself."Directory Authority IPs are hardcoded in the TBB tarball, which (wise) Tor users verify using the detached signature against the signing key." — The Tor Project blog